Mozilla Bumps Security Bug Bounty To $3,000 73
Posted
by
kdawson
from the doing-well-by-doing-good dept.
from the doing-well-by-doing-good dept.
Trailrunner7 writes "In an effort to enlist more help finding bugs in its most popular software — Firefox, Thunderbird, and Firefox Mobile — Mozilla is jacking up the bounty it pays to researchers who report security flaws to $3,000. 'For new bugs reported starting July 1st, 2010 UTC we are changing the bounty payment to $3,000 US per eligible security bug. A lot has changed in the 6 years since the Mozilla program was announced, and we believe that one of the best ways to keep our users safe is to make it economically sustainable for security researchers to do the right thing when disclosing information,' said Lucas Adamski, director of security engineering at Mozilla. In addition to Mozilla, Google also has established a bug bounty program — though at $500 it has been called 'insulting.' None of the larger software vendors such as Microsoft or Oracle have taken that step. Some researchers see that as inevitable, however."
The actual criteria (Score:5, Informative)
Mozilla also announced that the criteria for 'security bugs' require an attack vector that completely compromises the system from a remote location without internet connection. All other bugs are not treated as 'security' bugs, but rather: 'unwanted features', the bounty for this is of course limited to a 'quit complaining, you got it for free' letter.
OK, here are the actual criteria, fresh from TFA:
Re:Insulting? (Score:4, Informative)
What entitlement? Finding these major exploits are not easy and can easily take weeks or months or work to uncover. To think that $500 is a sufficient payment to recompense them for their work is a joke. Especially when they can get anywhere from 10 to 100 times that by selling these exploits to the black market.
Re:In related news... (Score:2, Informative)
4 Insightful?
Did you mods even read this? Completely compromises the system from a remote location without internet connection?
Cmon!
Bad Idea (Score:3, Informative)
Re:Insulting? (Score:3, Informative)
Re:Oblig Dilbert Quote (Score:3, Informative)
Re:Insulting? (Score:3, Informative)
No, Charlie Miller talks about much larger payouts from MS. He said, "I was shocked when I saw someone sign up to go after IE 8. You can get paid a lot more than $5,000 for one of those bugs. I’ve talked to a lot of smart, knowledgeable people and no one knows exactly how he did it. He could easily get $50,000 for that vulnerability. I’d say $50,000 is a low-end price point." here [zdnet.com].
Re:Insulting? (Score:2, Informative)